{
  "family": "cuegoe",
  "sample_count": 64,
  "category": "advanced_threat",
  "description": "Cuegoe (cataloged in cybersecurity threat intelligence databases and Malpedia under designations including Trojan:Win32/Cuegoe and Backdoor.Win32.Cuegoe) is a targeted cyber espionage trojan and backdoor first documented in 2015. Observed in targeted campaigns conducted by threat actors operating in the Asia-Pacific region, Cuegoe is distributed via spearphishing emails containing malicious documents or weaponized download links. The malware employs multi-stage payload decryption to unpack its core surveillance module directly into process memory. Cuegoe conducts thorough endpoint reconnaissance, collecting computer names, network interface configurations, and operating system build details. It establishes encrypted command-and-control channels over TCP, enabling remote operators to upload and download files, execute terminal commands, and maintain persistent lateral access within compromised victim networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Cuegoe",
    "Cuegoe",
    "Backdoor.Win32.Cuegoe",
    "Win32/Cuegoe"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Cuegoe malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cuegoe is a targeted cyber espionage trojan and backdoor observed in operations across the Asia-Pacific region."
      }
    },
    {
      "@type": "Question",
      "name": "How is Cuegoe delivered to targeted organizations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via spearphishing emails with weaponized document attachments or malicious download links."
      }
    },
    {
      "@type": "Question",
      "name": "What actions can remote operators perform using Cuegoe?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They can execute arbitrary shell commands, navigate local file systems, upload/download files, and pivot laterally."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cuegoe maintain persistence on Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It configures Windows registry Run keys and drops helper persistence binaries into system directories."
      }
    },
    {
      "@type": "Question",
      "name": "How can enterprise security teams detect Cuegoe?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy endpoint detection (EDR), monitor abnormal outbound TCP C2 sessions, and inspect registry startup entries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.001",
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; the aggressive system modifications make the machine fundamentally untrustworthy and likely open to secondary payloads.",
    "Utilize EDR or offline registry analysis tools to identify and reverse the malicious registry modifications (especially those disabling security tools).",
    "Audit the `HOSTS` file (`C:\\Windows\\System32\\drivers\\etc\\hosts`) and remove any entries redirecting security vendor domains to `127.0.0.1`.",
    "Due to the depth of the system modifications, the most secure remediation is a complete, clean rebuild of the operating system."
  ],
  "what_to_avoid": [
    "Do not trust the endpoint's built-in security tools or logs; a Cuegoe infection is explicitly designed to disable or tamper with these mechanisms.",
    "Avoid relying solely on automated AV removal, as the malware may have replaced legitimate system files that AV cannot safely delete."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "State-Sponsored Cyber Espionage",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2015,
  "threat_actor": "Asia-Pacific Cyber Espionage Group",
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Weaponized Office Documents",
    "Compromised Strategic Web Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Remote Command Execution",
    "System Hardware & Network Profiling",
    "Bidirectional File Transfer",
    "Encrypted TCP C2 Communication",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Custom encrypted TCP sessions over non-standard network ports",
      "Periodic heartbeat beacons transmitting victim GUIDs"
    ],
    "evasion_techniques": [
      "Multi-stage payload decryption in RAM",
      "Masquerading as Windows administrative services"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CuegoeClient",
      "%SystemRoot%\\System32\\cuegoe_svc.exe"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Targeted enterprise espionage, lateral movement, unauthorized command shell access"
  },
  "lineage": {
    "derived_from": [
      "Custom Targeted Backdoor Toolkits"
    ],
    "variants": [
      "Cuegoe.A",
      "Cuegoe.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a",
      "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b"
    ],
    "delivery": [
      "briefing_doc.exe",
      "cuegoe_loader.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CuegoeDaemon",
      "%AppData%\\Cuegoe\\cuegoe.exe"
    ]
  },
  "sources": [
    {
      "name": "Malpedia Threat Intelligence - Cuegoe Malware Family",
      "url": "https://malpedia.caad.fkie.fraunhofer.de"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Cuegoe",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Cuegoe"
    }
  ]
}